// p starts as null but is reassigned before deref; future M7 follow-up
// will model the reassignment via the encoder. For today this fixture
// documents the false-positive shape — the current first-cut detector
// will flag it because it only sees the initializer.
int g_x = 0;
int null_guarded() {
    int* p = nullptr;
    p = &g_x;
    return *p;
}